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23 1. In 2018, California Attorney General Xavier Becerra launched an investigation into the 

24 business practices of Facebook Inc., following widespread reports that Facebook allowed third 

25 parties to harvest Facebook users’ private information. What initially began as an inquiry into the 

26 Cambridge Analytica scandal expanded over time to become an investigation into whether 

27 Facebook has violated California law by, among other things, deceiving users and ignoring its 

28 own policies in allowing third parties broad access to user data. 
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2. Early in the investigation, the Attorney General used his pre-litigation investigatory 
powers granted by section 111 80 seq. of the Government Code to issue an investigative 
subpoena requiring Facebook to produce documents relating to the Cambridge Analytica matter. 
A year passed before Facebook completed its drawn-out response to the subpoena, during which 
time the Attorney General also issued a first set of investigative interrogatories. 

3. On June 17, 2019, the Attorney General served a second set of interrogatories and a 
further subpoena to delve deeper into matters disclosed in Facebook’s initial responses and later 
news reports concerning other claims of wrongdoing by Facebook over users’ privacy. 
Facebook’s responses to this second subpoena and set of interrogatories is patently deficient. 
Despite repeated entreaties, Facebook has provided no answers for nineteen interrogatories and 
produced no new documents in response to six document requests. Facebook has also wholly 
refused to search communications involving senior executives for responsive materials. Thus, 
Facebook is not just continuing to drag its feet in response to the Attorney General’s 
investigation, it is failing to comply with lawfully issued subpoenas and interrogatories. 

4. Accordingly, the People of the State of California, acting through Attorney General 
Xavier Becerra, petition this Court pursuant to section 11188 of the Government Code to enforce 
compliance with the Attorney General’s investigative subpoena and interrogatories. This 
investigation involves serious allegations of unlawful business practices by one of the richest 
companies in the world, prompting inquiries by Congress, European and U.S. regulators at the 
state and federal level. Indeed, the Federal Trade Commission recently announced a $5 billion 
settlement after the company violated an existing consent decree. Facebook’s delays and refusals 
to comply with the Attorney General’s interrogatories and subpoena should not thwart this 
important and independent investigation into whether the company violated its users’ privacy and 
California law. 

THE PARTIES 

5. Petitioner Xavier Becerra is the Attorney General of the State of California. Fie brings 

this action solely in his official capacity on behalf of the People of the State of California. As the 

chief law officer of the State of California, the Attorney General is responsible for enforcing the 
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state’s consumer protection laws, among others. In order to carry out these duties effectively, 
California law gives the Attorney General broad investigative powers. Specifically, Government 
Code sections 11180 et seq. grant the Attorney General, as head of the Department of Justice, the 
authority to issue subpoenas and promulgate interrogatories. The Attorney General may use these 
powers for various reasons, including assisting him in considering possible prosecutorial actions, 
proposing legislation, and formulating enforcement policies with other agencies. These 
investigative powers are not dependent on the initiation of a civil lawsuit or an administrative 
proceeding. If a party disobeys a subpoena, the Attorney General may petition the Superior Court 
for enforcement. 

6. Facebook needs no introduction. The Silicon Valley-based social media giant, which 
has grown to include the Facebook, WhatsApp, and Instagram platforms, is the fifth largest 
company in the United States by market capitalization, sixth most profitable, and boasts nearly 
40,000 employees. Most adults with internet access use Facebook, many of them to share the 
intimate details of their lives with friends and family. Facebook gathers and maintains personal 
information of billions of users throughout the world and millions in California. This data 
gathering occurs both on Facebook’s own platforms and through widespread surveillance that 
Facebook conducts on other websites and online activities. The company then monetizes the data 
through the provision of highly targeted advertisements to customized audiences on Facebook’s 
products, making the company billions in revenue. 

JURISDICTION AND VENUE 

7. Jurisdiction and venue are proper in the Superior Court of the State of California in the 
City and County of San Francisco under Government Code section 11186. The Attorney General 
primarily conducts the investigation into Facebook in the City and County of San Francisco, with 
some work perfonned in other parts of the State. 

BACKGROUND 

I. The Facebook Platform 

8. Among other endeavors, Facebook operates a social media platform that allows 

individuals and organizations to create personalized online profile pages about themselves, filled 
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with biographical details, photos, and a scrollable record of chronological “posts” about the user. 
Facebook also lets users connect with other users as “Friends,” and as relevant here, purports to 
allow users to restrict access to their information using various privacy settings. 

9. In 2007, Facebook launched a developer portal that let third-party software developers 
create applications that interacted with Facebook users. These “Facebook apps,” like apps on a 
mobile phone, were small programs that operated on Facebook’s website or mobile app. 

Facebook apps included popular games or quizzes that allowed a user to post serious or humorous 
results, such as what fictional character a user’s personality resembles. To make them 
personalized, Facebook granted apps the ability to access data about users from Facebook’s 
database. For example, a horoscope app might capture a user’s birthdate to provide the 
horoscope. Facebook made millions of apps available to users, opening the door for millions of 
apps to collect user data. 

10. Facebook also allowed apps to access non-public data—information that users thought 
they had restricted—about both themselves and their Friends. Some app providers, appear to 
have exploited this access to collect other user data, build profiles on users, and sell those to third 
parties. This includes apps affiliated with Cambridge Analytica, which obtained data on 87 
million Americans that was allegedly used to conduct election-related disinformation campaigns. 
Questions have arisen as to what Facebook knew about this conduct, why it failed to prevent app 
providers from misusing user data, and whether this behavior violated California law. 

11. In addition, Facebook told users that the company had safeguards in place to protect 
their data, and it offered controls that purported to allow users to decide whether and how their 
data was shared. However, the Cambridge Analytica, scandal, combined with reports that 
Facebook allowed its business partners to access user data, even when those users had opted out 
of such sharing, suggests that Facebook may not have honored its obligations to its users, or 
complied with California’s privacy or consumer protection laws. 

II. The Attorney General’s Investigation 

12. California law grants the Attorney General the authority to investigate reports of 

unlawful, unfair, deceptive, or otherwise improper business practices, including 
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misrepresentations to consumers, failures to make adequate disclosures in connection with 
personal information and online services, and violations of individuals’ privacy. Using this 
authority, the Attorney General initiated an investigation and continues to investigate Facebook’s 
compliance with California’s privacy and consumer protection laws, including but not limited to 
the allegations set forth above. 

13. On June 4, 2018, the Attorney General, acting through officers of the Department of 
Justice to whom he had delegated investigative authority under section 11182 of the Government 
Code, served Facebook with a subpoena for documents based on the allegations involving 
Facebook and Cambridge Analytica. Facebook accepted service of the subpoena and 
acknowledged its receipt. Facebook made its last production of documents in response to this 
first subpoena on April 17, 2019, but the company wrote that it planned to make'additional 
productions “on a rolling basis.” On June 5, 2019, a year and a day after the subpoena issued, 
Facebook finally admitted that it had actually completed its production of documents. 

14. On June 17, 2019, the Attorney General, acting through officers of the Department of 
Justice exercising delegated authority, properly served Facebook with a second set of 
investigative interrogatories and a second investigative subpoena, requesting additional 
information and documents. Copies of the investigative interrogatories and subpoena are attached 
as Exhibit A and B and are incorporated into this petition. Facebook was subpoenaed and 
required to answer interrogatories in the manner prescribed in section 11180 et seq. of the 
Government Code. The interrogatories and the subpoena, respectively, provided notice of the 
time and place for answering the interrogatories and for production of the papers. (Gov. Code, § 
11187, subd. (b)(1).) By agreement, Facebook’s attorneys accepted service of the interrogatories 
and subpoena. 

15. The Attorney General’s interrogatories and subpoena were regularly issued, and they 
relate to the Attorney General’s ongoing investigation into Facebook’s compliance with consumer 
protection and privacy laws. The investigatory interrogatories seek the following relevant 
information: 

• The number of California users and rates at which they activated privacy settings to 
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prevent apps from accessing data; 

• The effects of the various privacy settings on third parties’ access to data, including which 
apps Facebook granted access to user data despite users restricting access to their 
information; 

• Information about Facebook’s enforcement of its policies against developers; 

• An explanation of the technical workings of Facebook’s software that allowed various 
entities to access user data. 

The Attorney General’s subpoena seeks the following materials: 

• Communications among executives regarding: 1) any consideration of the need to audit 
developers’ access to user data; 2) third parties granted expanded access to user data; 3) 
the relationship between ad spending and access to data; 4) significant privacy-related 
news stories; and 5) the introduction of new privacy features. 

• Documentation regarding the changes to and user testing of Facebook’s privacy settings; 

« Communications regarding a user’s likely response to privacy settings; 

• Documents regarding Facebook’s privacy program, which was mandated by the Federal 
Trade Commission in 2012 pursuant to a consent decree, yet failed to prevent the 
Cambridge Analytica scandal. 

III. Facebook has failed to adequately and substantively respond. 

16. Facebook broadly refuses to answer the interrogatories or comply with the subpoena 
as required. Facebook will not provide a direct answer to 19 out of 27 interrogatories (Nos. 26- 
37, 40-42, & 47-50) and has only provided a partial response to 6 (Nos. 24, 25, 43, 44, 45, & 46). 
Facebook has produced no new documents for six document requests (Nos. 19-21 & 26-28), and 
appears to have conducted an insufficient search for request no. 25. 

17. Facebook has also refused to conduct a complete search for responsive documents. 
Facebook has, for example, refused to search for communications among senior executives 
regarding terminating developers’ access to user data, various privacy-related news stories, and 
Facebook’s public responses. On information and belief, Facebook has not searched the emails 

of the company’s Chief Executive and Chief Operating Officers for documents responsive to the 
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18. This lack of cooperation, particularly with respect to communications among senior 
executives, is not unique to the Attorney General’s investigation. A member of the Federal Trade 
Commission recently wrote to express serious concerns over Facebook’s candor with federal 
regulators: 

Based on the material presented to me, I was very concerned about Facebook’s 
cooperation and candor in its dealings with the Commission and its staff. In my view, 
there were multiple inconsistencies and deficiencies in Facebook’s responses to 
questions. I questioned whether the company’s document productions were truly 
complete. I believe that Facebook struggled to answer many requests for data, and I 
ascertained that the company was resistant to providing documents from 
Zuckerberg’s files. 

(Dissenting Statement of Commissioner Rohit Chopra, In re Facebook, Inc., Federal Trade 
Commission File No. 1823109, July 24, 2019, at page 6.) 

Ill 
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Pursuant to Government Code sections 11186-11188, the Attorney General prays that this 
Court: 

1. Issue an order directing Respondent to appear before this Court and to show cause 
why it has refused to comply with the Subpoena and Interrogatories, and, upon Respondent’s 
failure to show cause; 

2. • Enter an order directing Respondent to provide full responses to Interrogatories Nos. 
26 - 37, 40 - 42, and 47-50; complete its response to Interrogatories Nos. 24, 25, 43, 44, 45, & 
46; and produce documents for Requests for Production Nos. 19-21 and 25-28; and 

3. All other relief to which the people are legally entitled. 

Dated: November 6, 2019 Respectfully Submitted, 

Xavier Becerra 

Attorney General of California 

Nicklas A. Akers 

Senior Assistant Attorney General 

Stacey D. Schesser 

Supervising Deputy Attorney General 



Micah C. E. Osgood 
Lisa B. Kim 
Susan Saylor 
Maneesh. Sharma 
Deputy Attorneys General 
Attorneys for the People of the 
State of California 
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NOTICE to Benjamin A. Powell, Esq.: You are hereby served on behalf of Faceboolc, Inc. 


22 


pursuant to your agreement to accept service on your client’s behalf. 
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Pursuant to the powers conferred by Article 2 of Chapter 2 of Division 3 of Title 2 of the 
Government Code of California (Cal. Gov. Code, § 11180 et seq.) on the Attorney General, as 
head of the California Department of Justice, which powers and authority to conduct the above 
entitled investigation have been delegated to the undersigned, an officer of that Department, 

FACEBOOIC, INC. 

(hereinafter “FACEBOOIC’) IS HEREBY COMMANDED to produce the documents, books, 
records, papers and other items (collectively “Items”) described in Attachment A to this 
Investigative Subpoena which are in FACEBOOIC’s custody, possession or control, or the 
custody, possession or control of FACEBOOIC’s subsidiaries, affiliates, parents, predecessors, 
successors, employees, partners, officers, agents or representatives, whether or not the present 
location of any of the Items designated is in California, at the California Department of Justice, 
Office of the Attorney General, 1300 “I” Street, Sacramento, CA 95814-2919, ATTN: Deputy 
Attorney General Lisa B. Kim, within thirty days of service hereof. 

INSTRUCTIONS FOR COMPLIANCE 

1. If FACEBOOIC claims that an item or a portion of an item is privileged and 
FACEBOOIC withholds it from production for that reason, FACEBOOIC must create and submit a 
privilege log which lists: (1) tire authors and their capacities; (2) the recipients (including cc’s 
and bee’s) and their capacities; (3) other individuals with access to the document and their 
capacities; (4) the type of document; (5) the subject matter of the document; (6) the purpose(s) for 
the creation of the document; (7) the date on the document; and (8) a detailed explanation setting 
forth the factual and legal basis for your claim that the document is privileged or otherwise 
immune from production. 

2. To the extent responsive items exist in an electronic or computerized format, 
please contact the officer issuing this subpoena to discuss the manner and format in which the. 
items are to be produced so as to facilitate the production of full and complete copies in a usable' 
format. In the absence of an agreement regarding the manner and format of production, the 
following instructions shall apply: 
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a. The information shall be provided in accordance with the California 
Attorney General’s Office Production Format as outlined in Attachment B below, 

. b. The response shall, include all DOCUMENTS and computer programs 
necessary to the accurate conversion, analysis, and review of the electronic data, including but not 
limited to operating instructions, manuals and user guides, keys, legends, and codes for systems, 

' programs, files, and data fields. 

3. This Investigative Subpoena has been issued in connection with an investigation 
within the scope of section 131 of the California Penal Code. 

4. No item requested herein shall be destroyed or discarded by FACEBOOIC until the 
Attorney General has made a written determination that the item in question is not necessary for 
furtherance of this investigation. 

5. When producing items, identify by number the requests) to which the Item is 
responsive, 

6. As used herein, the past tense includes the present and future tenses, the present 
tense includes the past and future tenses, and the future tense includes the past and present tenses; 
tenses must be construed in the manner that would include, rather than exclude, information. 

7. As used herein, the singular includes the plural and the plural includes the singular, 
and must be construed in the manner that would include, rather than exclude, information. 

DEFINITIONS 

For purposes of this investigative subpoena, the terms set forth below are defined as 
follows: ' 

1. “APPS OTHERS USE” means the setting used to limit data SHARED through 
FRIENDS with THIRD PARTY APPLICATIONS as set out on page 19 et seq. of the March 15, 
2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 

2. “COMMUNICATION^)” means every disclosure, transfer, exchange, OR 
transmission of information, whether oral, written, OR electronic, and whether face-to-face, by 
telecommunications, telephone, computer, mail, e-mail, text message, instant message, 
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FACEBOOK Messenger, screenshot, picture, facsimile (fax) machine, OR otherwise, including 
any and all attachment(s). 

3. “DATA CONTROLS” means the settings that a user can alter or accept to limit 
the sharing of USER INFORMATION with third parties, including audience selectors, 
GRANULAR DATA PERMISSIONS, PLATFORM OPT OUT, APPS OTHERS USE, and the 
like. 

4. “DEVELOPER(S)” means any natural or corporate person that develops an 
application, software experience, game, or website, that accesses information from 
FACEBOOK’s APIs or other FACEBOOK software. 

5. “DOCUMENT(S)” means a “writing” as defined in section 250 of the California 
Evidence Code, and includes COMMUNICATIONS, e-mails, voicemails, computer files, text 
messages, instant messages, word processing documents, spreadsheets, databases, calendars, and 
all other forms of “electronically stored information” as defined in s'ection 2016.020 of the 
California Code of Civil Procedure. 

6. “EXTENDED API ACCESS PARTNER(S)” means the entity or entities with 
whom FACEBOOK partnered with for EXTENDED API ACCESS PARTNERSHIPS. 

7. “EXTENDED API ACCESS PARTNERSHIP” means a partnership formed by 
agreement between FACEBOOK and a DEVELOPER that allowed the DEVELOPER access to 
certain FACEBOOK APIs on terms specified within the agreement, such as FB-CA-CAAG- 
0002916, and beyond those terms offered to typical THIRD PARTY APPLICATIONS on the 
FACEBOOK Platform, This definition includes agreements performing the same general 
function, even if not titled as an “Extended API Addendum.” 

8. “FACEBOOK PRODUCT” means the social networking online service operated 
by FACEBOOK, Inc. where USERS access content, including THIRD PARTY 
APPLICATIONS, websites, and games, For purposes of this subpoena, FACEBOOK . 
PRODUCT means content accessed online at www.facebook.com and FACEBOOK’s mobile 
application, but does not include acquired properties, such as Instagram and WhatsApp. 
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1 9. “FRIEND” means a USER who is connected to another USER on the 

2 FACEBOOK PRODUCT, 

3 10. “GRANULAR DATA PERMISSIONS” refers to the setting used to limit data 

4 SHARED with THIRD PARTY APPLICATIONS as set out at page 4 et seq. of the March 15, 

5 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 

6 11. “INSTANT PERSONALIZATION” means the product that FACEBOOIC offered 

. 7 that used FACEBOOK USER INFORMATION to provide personalized experiences on select 

8 partners’ websites, as described by FACEBOOK in its December 18, 2018 Newsroom post found 

9 online at https://newsroom.fb.com/news/2018/12/faceboolcs-partners/ . 

10 12. “INSTANT PERSONALIZATION PARTNER(S)” means the entity or entities 

11 with whom FACEBOOK partnered for INSTANT PERSONALIZATION. 

12 13. “INSTANT PERSONALIZATION PARTNERSHIP” means the relationship 

13 FACEBOOK had with INSTANT PERSONALIZATION PARTNERS. ■ 

14 14. • “INTEGRATION PARTNER(S)” means the entity or entities with whom 

15 FACEBOOK has an INTEGRATION PARTNERSHIP. 

16 15. “INTEGRATION PARTNERSHIP(S)” means the relationship FACEBOOK has 

17 with companies that built integrations for a variety of devices, operating systems, and other 

18 products, as described by FACEBOOK in Appendix A of the July 20,2018 letter Anjan Sahni 

19 sent to Stacey D.'Schesser and Lisa B, Kim. 

20 16. “PLATFORM OPT OUT” means the setting used to disable platform as set out at 

21 page 10 et seq. of the March 15, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and 

22 Lisa B. Kim,- 

23 17. “POLICY” or “POLICIES” mean any formal or informal policy, procedure, rule, 

24 guideline, collaborative document, directive, instruction, OR practice, whether written or 

25 unwritten, that YOU expect YOUR employees to follow in performing their jobs. 

26 18. “PROFILE CONTROLS” means the settings that control what information in a 

27 USER’S profile is SHARED with other USERS through audience selectors, such as phone 

28 number, email, current city, birthday, relationship status, work, and education. 
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19, “SHARE” or “SHARES” or “SHARING” or “SHARED” means to provide, 
communicate, transfer, release, disclose, disseminate, sell, rent, trade, OR otherwise make 
accessible or available in writing, electronically, or by other means. 

20, “THIRD PARTY APPLICATION(S)” shall have the same meaning as the terms 
“Platform Application(s)“application(s),” and “app” used in FACEBOOK’s policies produced 
to the California Attorney General bearing the Bates Labels FB-AG-00000001 through FB-CA- 
CAAG-00000305. 

21, . “USER(S)” means the individuals who maintain an account and can generally 
access the typical FACEBOOK experience via website or mobile application in.a personal 
capacity. 

22, “USER INFORMATION” means any information related to the FACEBOOK 
PRODUCT that identifies, relates to, describes, or is capable of being associated with, a particular 
individual, including, but not limited to, the following information: name; physical address, 
including street name and name of a city or town; telephone number; email address; online 
contact information, including a screen name, username, or social network profile that functions 
as online contact information; user account credentials; a persistent identifier such as a user 
number held in a cookie or a processor serial number; a unique device identifier or a universally 
unique identifier, including FBID; geolocation information, including GPS-based location 
information and network-based or cell-based location information; longitude and latitude data; 
education; employment; employment history; and any other social media content generated by 
OR associated with a particular individual; including status updates, likes, OR group affiliations. 

23, “YOU” or “YOUR” or “FACEBOOK” means FACEBOOK, Inc. and its past or 
present officers, agents, employees, attorneys, predecessors, affiliates, subsidiaries, parent 

III 
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III 
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III 
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1 companies, former business names, and dbas, and anyone acting on YOUR behalf or at YOUR 

2 direction. 


FAILURE TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THE 
PROCEEDINGS AND PENALTIES PROVIDED BY LAW. 


7 Dated: June 17,2019 


Xavier Becerra 

Attorney General of California 

Nicklas A. Akers 

Senior Assistant Attorney General 

Stacey D, Schesser 

Supervising Deputy Attorney General 

Lisa B. Kim 

Susan Saylor 

Micah C.E. Osgood 

Maneesh Sharma 

Deputy Attorneys General 


SF2017402454 
13780i66.docx. 


Lisa B. Kim ' 

Deputy Attorney General 
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ATTACHMENT A 


2 18. Records tracking the USER DATA access permissions granted.to DEVELOPERS 

3 pursuant to an EXTENDED API ACCESS PARTNERSHIP. 

4 19. All YOUR internal COMMUNICATIONS from 2013 to 2018 reflecting the 

5 contemplation, planning, or performance of a general audit of DEVELOPERS’ access to USER 

6 INFORMATION, including through THIRD PARTY APPLICATIONS, INTEGRATION 

7 PARTNERSHIPS, INSTANT PERSONALIZATION PARTNERSHIPS, and EXTENDED API 

8 ACCESS PARTNERSHIPS. 

9 '20. All COMMUNICATIONS concerning the negotiation of, entrance into, or 

10 termination of, an EXTENDED API ACCESS PARTNERSHIP. 

11. 21, All COMMUNICATIONS from 2012 to 2015 regarding conditioning 

12 DEVELOPERS’ access to USER INFORMATION on advertising spending or other payment. 

13 22, All DOCUMENTS that support YOUR contention that FACEBOOK ", never 

14 implemented, let alone seriously considered” (emphasis in the original) “charging developers for 

15 access to user data,” as stated on page 6 of the April 17, 2019 letter from Benjamin A. Powell to 

16 Stacey D, Schesser and Lisa B. Kim. 

17 23. All DOCUMENTS reflecting the study, testing, or analysis of a USER’S 

18 understanding of, or reaction to, a DATA CONTROL in effect during 2013 to present, or any 

19 proposed change to a DATA CONTROLS during that time frame, including any A/B testing, or 

20 studies on user experience or usability of DATA CONTROLS. 

21 24. All COMMUNICATIONS regarding a USER’S potential reaction to or 

22 understanding of DATA CONTROLS. 

23 25. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, 

24 or above, about the development of the “privacy tour,” “privacy basics,” or “privacy check-up,” 

25 as those terms were used by in the March 15, 2019 letter from Benjamin A, Powell to Stacey D. 

26 Schesser and Lisa B, Kim. 

27 26. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, 

28 or above, about the termination of a DEVELOPER’S access to USER INFORMATION. 
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27. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, 
or above, that occurred within one week of a request for comment regarding, or the publication 
of, the following news reports: 

• The Guardian’s reporting on December 11, 2015, that “Ted Cruz us[ed] [a] firm 
that harvested data on millions of unwitting Faceboolc users”; 

• Various news outlets reporting on March 17, 2018, about Faceboolc and 
Cambridge Analytica; 

• The New York Times reporting on June 3,2018, that “Faceboolc gave device 
makers deep access to data on users and friends”; 

• The Wall Street Journal reporting on November 28,2018, that “Faceboolc 

x considered charging for access to user data”; 

• The Washington Post reporting on December 5, 2018, that “Faceboolc [allegedly] 
offered advertisers special access to users’ data and activities”; and 

• The New York Times reporting on December 18, 2018, that “Faceboolc gave some 
of the world’s largest technology companies more intrusive access to users’ 
personal data.” 

28. All YOUR internal COMMUNICATIONS, involving a Director, Vice President, 
or above, regarding approval of the following Faceboolc Newsroom items: 

• Why We Disagree with the New Yorlc Times, dated June 3, 2018; 

• Response to Six4Three Documents, dated December 5, 2018 

• Let’s Clear Up a Few Things About Faceboolc’s Partners, dated December 18, 
2018. 

• Facts About Facebook’s Messaging Partnerships, dated December 19,2018; 

• Cracking Down on Platform Abuse, dated March 21, 2018; 

29. All YOUR internal POLICIES on the enforcement of FACEBOOK’s Platform 
Policy, Data Policy, Terms of Service, of Statement of Rights and Responsibilities, on THIRD 
PARTY APPLICATIONS, INTEGRATION PARTNERSITIPS, INSTANT 
PERSONALIZATION PARTNERSHIPS, and EXTENDED API ACCESS PARTNERSHIPS. 

30. All “Enforcement Rubric[s]” used by FACEBOOK, as that term is used on page 4 
of the April 17, 2019 letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B, Kim. 

31. All “cease and desist letters” sent by FACEBOOK to DEVELOPERS, between 
January 1,2013, and March 1, 2018, as that term is used on page 12 of the July 20, 2018 letter 
from Anjan Sahni to Stacey D. Schesser and Lisa B. Kim. 
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32. All “letter agreements” resolving an enforcement concern as that term is used on 

2 

page 12 of the July 20, 2018 letter from Anjan Sahni to Stacey D. Schesser and Lisa B, Kim. 

3 

33. FACEBOOIC’S logs documenting any code changes made to DATA CONTROLS, 

4 

• 

sometimes referred to as “Commit Logs.” 

5 

34. All “Privacy Risk Assessments],” and notes or agenda relating to FACEBOOIC’s 

6 

“focused subject-matter-specific meetings,” “weekly intra- and inter-team meetings,” and 

' 7 

“Privacy Summit[s],” as detailed in “Faceboolc’s Privacy Program Overview” at page 9 of the 

8 

1 

“Independent Assessor’s Report on Facebook’s Privacy Program” at FB-CA-CAAG-00131372. 

9 

35. All transcripts of deposition or other testimony by FACEBOOK former and 

10 

current employees in the litigation titled, Six4Three, LLC v. Facebook, Inc.' (Case No. CIV 

11 

533328), Superior Court of the State of California, County of San Mateo, filed on April 10, 2015, 

12 

36. FACEBOOK’s discovery responses, excluding documents produced, in the • 

13 

litigation titled, Six4Three, LLCv. Facebook, Inc. (Case No. CIV 533328), Superior Court of the 

14 

. State of California, County of San Mateo, filed on April 10, 2015. 

15 

37. FACEBOOK’S responses to any formal or informal requests for information, 

16 

interrogatories, or other discovery, excluding documents produced, to the Federal Trade 

17 

Commission regarding its investigation into FACEBOOK’S privacy practices, after entry of the 

18 

Federal Trade Commission’s July 27, 2012 Decision and Order, in its action titled In the Matter 

19 

of Facebook, Inc. Doc. No. 0923184. 
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California Attorney General's Office 
PRODUCTION FORMAT 

I PRODUCTION OF ELECTRONICALLY STORED INFORMATION (ESI) 

A. Load files. Except where noted in section (K) below, all ESI is to be produced in electronic format, 
with file suitable for loading into a Concordance compatible litigation support review database. All 
productions will include both image and metadata load files, as described in Appendix A: Load File 
Format. 

B. Metadata Fields and Processing. Each of the metadata and coding fields set forth in Appendix B that 
can be extracted from, a document shall be produced for that document. The parties are not obligated to 
populate manually any of the fields in Appendix B If such fields cannot be extracted from a document. 

C. System Files. Common system and program files need not be processed, reviewed or produced. The 
producing party shall keep an inventory of the system files not being produced and the criteria (e.g., non¬ 
human readable file, etc.) for not processing the files. 

D. Email. Whenever possible, email shall, be collected from the producing party's email store or server 
(e.g., MS Exchange, Lotus Notes) because this is the most reliable source from which to produce and ‘ 
maintain email metadata and structure. Metadata and "header fields” shall be extracted from email 
messages. Email messages, meeting notices, calendar items, contacts and tasks shall all be extracted from 
the- email archives. 

E. De-Duplication. Removal of duplicate documents shall only be done on exact duplicate documents 
(based on MD5 or SHA-1 hash values at the document level) across all custodians (global), and the 
Custodian field will list each Custodian, separated by a semicolon, who was a source of that document 
prior to deduplication. If a party is unable t o provide such infonna tionwitlnnthe Custodian field, or if 
global, deduplication could otherwise limit the ability to provide that a particular document was possessed 
by a custodian, then removal of duplicate documents shall only be done on exact duplicate documents 
(based onMD5 or SHA-1 hash values at the document level) within a source (custodian). 

F. TIFFs/JPGs. Single-page Group IV TIFF images shall be provided using at least 300 DPI print 
setting. Each image sliall have a unique file name, which is tire Bates number of the document Original 
document orientation shall be maintained (?.&, portrait to portrait and landscape to landscape). TIFFs will 
show any and all text and images which would be visible to the reader using tire native software that 
created the document. Documents containing color need not be produced initially in color. However, if an 
original document contains color necessary to understand the meaning or content of the document, the 
producing party will honor reasonable requests for a color image of the document. If color images are to 
be produced, they will be provided in JPG format 

G. Embedded Objects. Objects embedded in Microsoft .Wor d and .RTF documents, which have been 
embedded with the "Display as Icon" feature, will be extracted as separate documents and treated like 
attachments to the document. Other objects embedded in documents shall be produced as native files. 

< 
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H. Compressed files. Compression file types fag., .CAB, .GZ, .TAR, .Z, .ZIP) shall be decompressed in 
a reiterative manner to ensure that a zip within a zip is decompressed into the lowest possible 
compression resulting in individual folders and/or files. 

I. Test Files, For each document,, a single text, file shall be provided along with the image files and 
metadata. The text filename shall be the same as the page Bates/control number of the first page of the 
document File names shall not have any s|3ecial characters or embedded spaces. Electronic text must be 
extracted directly from the native electronic file unless the document was redacted, an image file, or a 
physical file. In thes e instances a text file created using OCR will be produced in lien of extracted text. 

See Section R.C for OCR requirements. Under no circumstances shall the receiving party be required to 
rely upon a less accurate version of the text than the producing party. For example, if the producing party 
has access to extracted text from, electronic document files, the receiving party shall receive extracted text 
instead of OCR’d text genera ted from an image file. 

J. Redaction. If a file that originates in ESI needs to be redacted before production, die file will be 
rendered in. TIFF, and the TIFF will be redacted and produced However, to the extent that tlie text is. 
searchable in the native format, the producing party will still provide searchable text for those portions of 
the do crnnent that have not been redacted. 

K. Spreadsheets and Presentations. Various types of files, including but not limited to MS Excel 
spreadsheets, MS PowerPoint presentations, media files, etc., lose significant information and meaning 
when produced as an image. Any native files that are- produced shall be produced with a Bates-numbered 
TIFF image slip-sheet stating the document has been produced in native format. Any native files that are 
produced shall be produced with the Source File Path provided, as well as all extracted text and applicable • 
metadata fields set forth in Appendix B. • 

“ Spreadsheets. Excel spreadsheets shall be produced as a native document .file along with the 
attracted text and relevant metadata identified in Appendix B for the entire spreadsheet, plus a 
Bates-numb ered TIFF image slip-sheet stating the document has been produced in native format. 

* Presentations. PowerPoint presentations shall be produced as a native document file along with 
the extracted text and relevant metadata identified in Appendix B for the entire presentation, plus 
a Bates-numbered.T.IF.F image slip-sheet stating the document lias been produced in native' 
format. 

L. Other ESI that is Impractical to Produce in Traditional Formats. Tlie parties understand and 
acknowledge that certain cat egories of ESI are structurally complex and do not lend themselves to 
production as native format or other traditional formats. To the extent a. response to discovery requires 
production of discoverable electronic information contained in a database, the producing party shah 
consider methods of production best providing all relevant ^formation, including but not limited to 
duplication of databases or .limited access for-the purpose of generating reports. Parties should consider 
whether all relevant information may be provided by querying the database for discoverable information 
and generating a report in a reasonably usable and exportable electronic file (e.g. t Excel, CSV or SQL 
format). Tire parties agree to confer to obtain an appropriate resolution to such requests. 
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M. Endorsements. The producing party will brand all TIFF images in the lower right-hand comer- with 
its corresponding bates number, using a consistent font type and size. The bates number - must not obscure 
any part of the underlying data. The producing party will brand all TIFF images in the lower- left-hand 
comer with all confidentiality designations, as needed, in accordance with confidentiality definitions as 
agreed to by the parties. 

N. Exception Report. The producing party shall compile an exception report enumerating any 
unprocessed or unprocessable documents, then- file type and the Me location. 

O. Clawback procedure. Any documents recalled due to a mutually-agreed upon clawback provision 
shall have a specific protocol followed to ensure all copies of each such document are appropriately 
removed from the review database, backup and disaster recovery systems maintained by the opposing 
party. 
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II. PRODUCTION OF PHYSICALLY STORED INFORMATION (HARD COPY DOCUMENTS) 

A. TIFF.v, Hard copy paper documents shall be scanned as single-page. Group IV compression TIFF 
images using n print setting of at least 300 dots per inch (DPI). Each image shall have a unique file name, 
which is the Bates number of (he document Original document orientation shall be maintained (La., 
portrait to portrait and landscape to landscape). 


B. Metatlata Fields. The following information shall be produced for iiard copy documents and provided 
in the data load file at the same time that the TIFF images and the Optical Character Recognition (OCR) 
acquired text files are produced. Each, metadata field shall be labeled as listed below:. 



momm* m 

.Description . * | 

PARENTHOOD 

ABC00G0001 
(Unique ID Parent- 

Child Relationships) 

The Document ID number associated with the first page of a 
parent document (this field will only be populated in child 
records). 

GROUPID 

ABCOOOOOG1 
(Unique ID Parent- 
Child Relationships) 

The Document ID number associated with the first page of tine 
parent document, (inmost cases, this will be data in the 
BEGATTACH. field). 

BEGRATES 

ABC0000001 (Unique 

ID) 

The Document ID number associated with the first page of a 
document. 

ENDBAT.ES 

ABC0000003 (Unique 

ID) 

The Document ID number associated with the last page of a 
document. 

BEGATTACII 

ABCOOOOOOI (Unique 

ID Pareut-Child 
Relationships) 

The Document ID number associated with the first page of the parent 
document (if'applicable). 

ENDATTACH 

ABCOOOOOQ8 (Unique 

ID Parent-Child 
Relationships) 

The Document ID number associated with the last pa gc of the last 
attachment (if applicable). 

PGCOUNT 

3 (Numeric) 

The number of pages for a document, 

VOLUME 

VOLOOl 

The name of CD, DVD or Hard Drive (vendor assigns). 

CUSTODIAN 


The custodian/ source ofn document. Note; If lire documents are 
de-duped on a global level, this field will contain the name of each 
custodian from which the document originat ed. 
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C. OCR Acquired Text Fites, When subjecting physical documents to an OCR process, the settings of 
the OCR software shall maximize text quality over: process speed Any settings such as "auto-skewing", 
"auto-rotation" and the like shouldbe turned on when documents are run through the process. 

D, Database Load Files/Cross-Reference Files. Documents shall be provided with (a) a delimited 
metadata file (,dat or .txt) and (b) an image load file (.opt), ns detailed in Appendix A. 

F. Un it izing of Documents, hi scanning paper documents, distinct documents shall not be merged into a 
s ingle record, and single documents shall not be split into multiple records (e.g,, paper documents should 
be logically unitized). In the case of an organized compilation of separate documents - for example, a 
binder containing several separate documents behind numbered tabs - the doaiment behind eadi tab 
should be scanned separately, but the relationship among the documents in the binder should be reflected 
in proper coding of the beginning and ending document and attachment fields. The-parties will make their 
best efforts to unitize documents correctly, 
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APPENDIX A: REQUESTED LOAD FILE FORMAT FOR ESI 


1. Image File Format: All images, paper documents scanned to images or rendered ESI, shall 
be produced as 300 dpi single-page, CCITT Group IV TIFF images (for black/white) or JPG 
images (for color).. Documents should be uniquely and sequentially Bates numbered with an 
endorsement burned into each image, 

• All TIFF/JPG image file names shall include the unique Bates number burned into the 
image, 

• Each Bates number shall be a standard length, include leading zeros in the number and be 
unique for each producedpage. 

• All TIFF/JPG image files shall be named with .a “tif 1 or “.jpg 1 " extension. 

• Images should be able to be OCR’d using standard COTS products, such as LexisNexis 
LAW PreDiscovery, Ipro, etc. 

2. Concordance Image Cross-Reference file: Images shall be accompanied by a Concordance 
Image Cross-Reference file that associates each Bates number with its corresponding single-page 
TIFF/JPG image file, The Cross-Reference file should also contain the image file path for each. 
Bates numbered page. 

• Image Cross-Reference Sample Format: 

ABC000001,OLS,D:\DatabaseName\Image\001\ABC000001.TIF,Y 5 „ 

ABC000Q02,OLS, D:\DatabaseName\Image\001\ABC000002.TIF,,,, 

,ABC000003,OLS,D:\DatabaseName\Image\001\ABC000003.TIF,,,, 

ABC000004,OLS,D:\DatabaseName\Image\001\ABC0G0004.TIF,Y,„ 

3. Concordance Load File: Images shall also be accompanied by a “text load file” containing 
delimited text (DAT file) that will populate fields in a searchable, flat database environment, The 
delimiters for the load file should be. Concordance defaults. 

• Comma: ^ ASCII character (020) 

• Quote: J> ASCII character (254) 

• Newline: ® ASCII character (174) 
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ffRftNIRIbj ' . * :| 

PARENTDOCID 

ABC0000001 

(Unique ID Parent-Child 

Relationships) 

The Document ID number associated with 
the first page of a parent document (this 
field will only be populated in child 
records). 

GROUPID 

ABCOOOOQOl 

(Unique ID Parent-Child 

Relationships) 

The Document ID number associated with 
the first page of the parent document (in 
most cases, this will be data in the 
BEGATTACII field). 

BEGBATES 

ABC00000Q1 (Unique ID) 

The Document ID number associated with the 
first page of a document. 

ENDBATES 

ABCG000003 (Unique ID) 

' 

The Document ID number associated with the 
last page of a document. 

BEGATTACII 

ABCOOOOGOl (Unique ID Parent- 
Child Relationships) 

The Document ID number associated with (he 
first pHge of the parent document. 

ENDATTACH 

ABC0000008 (Unique ID Parent- 
Child Relationships) 

The Document ID number associated with the 
last page of the last attachment. 

PGCOUNT 

3 (Numeric) 

The number of pages for a document. 

VOLUME 

VOLOOl 

The name of CD, DVD or Hard Drive (vendor 
assigns). 

SENTDATE 

MM/DD/YYYY 

The date the email was sent. NOTE: For 
attachments to e-mails, tins field should be 
populated with the date sent of the email 
transmitting the attachment. 

SENTTIME 

HH:MM:SS 

The time the email was sent, 

CREATEDATE 

MM/DD/YYYY 

The date the document was created. 

CREATETIME 

HH:MM:SS 

The time the document was created. 

LASTMODDATE 

MM/DD/YYYY 

The date the document was last modified. 

LASTMODTIME 

HH.'MM.'SS 

The time the document was last modified 

RECEIVEDDATE 

MM/DD/YYYY 

The elate the document was received. 

RECEIVEDTIME 

HII:MM:SS 

The time die document was received 

FILEPATII 

i.e, Joe Smitli/E-mail/Inbox 

Joe Sniitli/E-mail/D eleted Items. 

Joe Smith/Loose 

Piles/Accounting/,.. 

Joe Smitli/Loose Files/Documents 
and Settings/..., 

Location of the original document. The source 
should be the start of the full path. 

APPLICATION 

MS Word, MS Excel, etc, 

Type of document by application, 

HIDDENTYPE 

Options: Trade Changes, Hidden 
Spreadsheet, Very Hidden 
Spreadsheet, etc. 

The type of hidden modification of the 
document (e.g. Track Changes,. Hidden 
Spreadsheet, Very Hidden Spreadsheet, etc) 

AUTHOR 

jsruith 

The author of a document from entered 
metadata. 
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FROM 

Joe Smith <jsmith@email.com> 

The display name and e-mail of the author of 
an e-mail. If only e-mail is given, then just 
list the e-mail address. An e-mail address 
should always be provided for evety 
document. 

TO 

Joe Smith <jsmifli@email.com>; 
tjones@email.com 

) 

The display name and e-mail of the 
recipients) of an e-mail. If only e-mail is 
given, then just list the e-mail address. An e- 
ma il address should always he provided for 
every document. 

cc 

Joe Smith <jsmilh@einail.com>; 
tjones@email.com 

The display name and e-mail of the copyee(s) 
of an e-mail. If only e-mail is given, then just 
list the e-mail address. An e-mail address 
should always he provided for every 
document. 

BCC 

Joe Smith <jsraifli@email.coin>; 
tjones@email.com 

The display name and e-mail of the blind 
copyee(s) of an e-mail. If only e-mail is 
given, then just list the e-mail address. An e- 
mail address should always he provided for 
every document. 

ESUBJECT 

Re: Scheduling Meet and Confer 

The email subject line. 

DOCTITLE 


The extracted document title or subject of a 
document. 

CUSTODIAN 


The custodian / source of a document. Note: 

If the documents are de-duped on a global 
level, this field will contain the name of each 
custodian horn which the document 
originated. 

ATTACH 

COUNT 

Numeric 

The number of attachments to a document. 

FILEEXT 

XLS 

The file extension of a document. 

FILENAME 

Docnraeiit Name.xls 

The file name of a document. 

HASH 


The AIDS or SHA-1 Hash value. 

NATIVELINK 

D:\NATIVES\ABCOOOOO 1 .xls 

The full path to a native copy of a document. 

FULLTEXT 

D:\TEXT\ABC000001.txt 

The path to the Hill extracted text of the 
document. There should be a folder on the 
deliverable, containing a separate Unicode text 
file per document. These text files should be 
named with their bates numbers. Note: E- 
mails should include header information: 
author, recipient, cc, bcc, date, subject, etc. If 
the attachment or e-file does not extract any 
text, then OCR for the document should be 

1 provided. 
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Matter Name: In the Matter of the Investigation of: FACEBOOK, INC. 

I declare: 

Lam employed in the Office of the Attorney General, which is the office of a member of the 
California State Bar, at which member’s direction this service is made. I am 18 years of age or 
older and not a party to this matter; my business address is 300 South Spring Street, Suite 1702, 
Los Angeles, CA 90013. 

On June 17.2019. 1 served the attached INVESTIGATIVE SUBPOENA FOR DOCUMENTS 
[SET TWO] by placing a true copy thereof enclosed in a sealed envelope with postage thereon 
fully prepaid, in the United States Mail at Los Angeles, California, addressed as follows: 

Benjamin A. Powell 
Maury Riggan 
WilmerHale 

1875 Pennsylvania Avenue NW 
Washington, DC 20006 
Beniamin.Powell@wilmerhale.com 
Maurv.Riggan@wilmerhale.com 


I declare under penalty of perjury under the laws of the State of California the foregoing is true 
and correct and that this declaration was executed on June 17, 2019, at Los Angeles, California. 


Carol Chow 
Declarant 
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STATE OF CALIFORNIA 


In the Matter of the Investigation of: 
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INVESTIGATIVE INTERROGATORIES 
[SET TWO] 

GOV. CODE § 11180 ETSEQ. 


To Benjamin A. Powell, Esq.: You are hereby served on behalf of Faceboolc, Inc. jfursuant 
to your agreement to accept service on your client’s behalf. 
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Pursuant to the powers conferred by Article 2 of Chapter 2 of Division 3 of Title 2 of the' 
Government Code of California (Cal. Gov. Code, § 11180 et seq.) on the Attorney General, as 
head of the California Department of Justice, which powers and authority to conduct the above 
entitled investigation have been delegated to the undersigned, an officer of that Department, 

FACEBOOK, INC. 

IS HEREBY COMMANDED to answer separately and fully in writing, under oath, within thirty 
days of service hereof, each of the following interrogatories. 

INSTRUCTIONS FOR COMPLIANCE 

1. The RELEVANT PERIOD for these investigatory interrogatories is January 1, 

2013 through December 31, 2018, unless otherwise expressly stated herein. 

2. Each answer must be as complete and straightforward as the information 
reasonably available to Facebook, Inc. (hereafter “FACEBOOK”), including the information . 
possessed by FACEBOOK’s attorneys or agents, permits. If an interrogatory cannot be answered 
completely, answer it to the extent possible, specifying the reasons for FACEBOOK’s inability to 
answer the remainder of the interrogatory and stating whatever information, knowledge, or belief 
that FACEBOOK has concerning the unanswered portion thereof. 

3. As used herein, the past tense includes .the present and future tenses, the present 
tense includes the past and future tenses, and the future tense includes the past and present tenses; 
tenses must be construed in the manner that would include, rather than exclude, information. 

,4. As used herein, the singular includes the plural and the plural includes the singular, 
and must be construed in the manner that would include, rather than exclude, information. 

5. If FACEBOOK is asserting a privilege or making an objection to an interrogatory, 

FACEBOOK must specifically assert the privilege or state the objection in FACEBOOK’s 

written response, and set forth in detail the basis for FACEBOOK’s objection or assertion of the 

privilege. If an objection pertains to only a portion of an interrogatory, or a word, phrase, or 

clause contained in it, FACEBOOK must respond to the remainder of the Interrogatory.- 

_ ' _._ 2 ___ 
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6. These Investigative Interrogatories have been issued in connection with an 
investigation within the scope of section 131 of the California Penal Code. 

7. FACEBOOK’s written responses shall be delivered to the California Department 

of Justice, Office of the Attorney General, 1300 “I” Street, Sacramento, CA 95814-2919, ATTN: 
Deputy Attorney General Lisa B. Kim. ^ 

DEFINITIONS 

For purposes of this set of investigatory interrogatories, the terms set forth below are 
defined as follows: . 

8. “APIs” has the same meaning used at https://developers.facebook.com/docs/apis- 
and-sdks/ and liked webpages, and the similar software that existed in the past. 

/ 

9. “APPS OTHERS USE” means the settings used to limit data accessible to THIRD 
PARTY APPLICATIONS that USERS’ FRIENDS installed, as set out on page 19 et seq. of the 
March 15,2019 letter from Benjamin A, Powell to Stacey D, Schesser and Lisa B. Kim. 

10. “AUDIENCE SELECTOR TOOL” means the setting used to set the audience for 
“status updates, photos and other things.you share,” as explained at 
https://www.facebook.eom/heb/l 2093 9471321735 . 

11. “DATA CONTROLS” means the settings that a USER can use to govern the 
sharing of USER INFORMATION with third parties, including AUDIENCE SELECTOR 
TOOLS, GRANULAR DATA PERMISSIONS, PLATFORM OPT-OUT, APPS OTHERS USE, 
and tire like. 

12. “DEVELOPER POLICIES” means all of the POLICIES that FACEBOOK 
expected DEVELOPERS to abide by, including FACEBOOK’s Statement of Rights and 
Responsibilities, Terms of Service, Date Use Policy, Platform Policy, and /or Data Policy. 

13. “DEVELOPERS” means any natural or corporate person that develops an 
application, game, or website, that accesses information from FACEBOOK’s APIs or other 
software. 

14. “EXTENDED API ACCESS PARTNERSHIP” means a partnership formed by 

agreement between FACEBOOK and a DEVELOPER that allowed access to certain 
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FACEBOOK APIs on terms specified within the agreement, such as FB-CA-CAAG-0002916, 
and beyond those terms offered to typical THIRD PARTY APPLICATIONS on the FACEBOOK 
Platform. This definition includes agreements performing the same general function, even if not 
titled as an “Extended API Addendum.” 

15. “EXTENDED API ACCESS PARTNER(S)” means the entity or entities with 
whom FACEBOOK has an EXTENDED API ACCESS PARTNERSHIP. 

16. “FACEBOOK PRODUCT” means the social networking online service operated 
by FACEBOOK, Inc. where USERS access content, including through THIRD PARTY 
APPLICATIONS, websites, and games. For purposes of these interrogatories, FACEBOOK 
PRODUCT means content accessed online at www.facebook.com and FACEBOOK’s mobile 
application, but does not include acquired properties, such as Instagram and WhatsApp, 

17. “FRIEND” means a USER who is connected to another USER on the 
FACEBOOK PRODUCT. 

18. “GRANULAR DATA PERMISSIONS” refers to the setting used to limit data 
shared with THIRD PARTY APPLICATIONS as set out at page 4 et seq. of the March 15, 2019 
letter from Benjamin A. Powell to Stacey D. Schesser and Lisa B. Kim. 

19. “INSTANT PERSONALIZATION” means the product that FACEBOOK offered 
that used FACEBOOK USER INFORMATION to provide tailored and integrated USER 
experiences on select partners’ websites, as described by FACEBOOK in its December 18, 2018 
Newsroom post found online at https://newsroom.fb.com/news/2018/12/facebooks-partners/ . 

20. “INSTANT PERSONALIZATION PARTNER(S)” means the entity or entities 
with whom FACEBOOK partnered for INSTANT PERSONALIZATION. 

21. ' “INSTANT PERSONALIZATION PARTNERSHIP” means the relationship 
FACEBOOK had with INSTANT PERSONALIZATION PARTNERS. • 

22. “INTEGRATION PARTNER(S)” means the entity or entities with whom 
FACEBOOK has an INTEGRATION PARTNERSHIP. 

23. ’ “INTEGRATION PARTNERSHIP(S)” means the relationship FACEBOOK has 

with companies that built integrations for a variety of devices, operating systems, and other 
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products, as described by FACEBOOK in Appendix A of the July 20, 2018 letter Anjan Sahni 
sent to Stacey D. Schesser and Lisa B, Kim. 

24. “PLATFORM OPT-OUT” means the setting used to disable the FACEBOOK 
platform as set out at page 10 et seq. of the March 15, 2019 letter from Benjamin A. Powell to 
Stacey D. Schesser and Lisa B. Kim. 

25. “POLICY” or “POLICIES” mean any formal or informal policy, procedure, rule, 
guideline, collaborative document, directive, instruction, OR practice, whether written or 
unwritten, that YOU expect YOUR employees to follow in performing their jobs, 

26. “PROFILE CONTROLS” means the settings that control what information in a 
USER’S profile is shared with other USERS through AUDIENCE SELECTOR TOOLS, such as 
phone number, email, current city, birthday, relationship status, work, and education. 

27. “SHARE” or “SHARES” or “SHARING” or “SHARED” means to provide, 
communicate, transfer, release, disclose, disseminate, sell, rent, trade, OR otherwise make 
accessible or available in writing, electronically, or by other means. 

28. “THIRD PARTY APPLICATION(S)” shall have the same meaning as the terms 

“Platform Application(s),” “application(s),” and “app” used in FACEBOOIC’s policies produced 
to the California Attorney General bearing the Bates Labels FB-AG-00000001 through FB-CA- 
CAAG-00000305. ' 

29. “USER(S)” means the individuals who maintain an account and can generally 
access the typical FACEBOOK experience via website or mobile application in a personal 
capacity. 

30. “USER INFORMATION” means any information related to the FACEBOOK 

PRODUCT that identifies, relates to, describes, or is capable of being associated with, a particular 

individual, including, but not limited to, the following information: name; physical address, 

including street name and name of a city or town; telephone number; email address; online 

contact information, including a screen name, username, or social network profile that functions 

as online contact information; user account credentials; a persistent identifier such as a user 

number held in a cookie or a processor serial number; a unique device identifier or a universally 
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1 unique identifier, including FBID; geolocation information, including GPS-based location 

2 " information and network-based or cell-based location information; longitude and latitude data; 

3 education; employment; employment history; and any other social media content generated by 

4 OR associated with a particular individual, including status updates, likes, OR group affiliations. 

5 31. “YOU” or “YOUR” or “FACEBOOK” means FACEBOOK, Inc. and its past or 

6 present officers, agents, employees, attorneys, predecessors, affiliates, subsidiaries, parent 

7 companies, former business names, and dbas, and anyone acting on YOUR behalf or at YOUR 

8 direction. 

9 INTERROGATORIES 
10 

11 INTERROGATORY NO. 24 

12 Provide, for each year during the RELEVANT PERIOD, the number of FACEBOOK 

13 USERS that indicated that they currently resided in California. 

■ I 

14 INTERROGATORY NO. 25 

15 Provide, for each year during the RELEVANT PERIOD, the default settings for each of the 

16 following DATA CONTROLS: . 

17 (a) AUDIENCE SELECTOR TOOL for status updates (e.g., “Who can see your 

18 future posts?”); 

19 (b) AUDIENCE SELECTOR TOOL for birthday; 

20 '(c) AUDIENCE SELECTOR TOOL for friends list; 

21 (d) AUDIENCE SELECTOR TOOL for email; 

22 (e) AUDIENCE SELECTOR TOOL for who could search for and find a person’s 

23 profile by contact information; 

24 (f) GRANULAR DATA PERMISSIONS; 

25 (g) PLATFORM OPT OUT; and, 

26 (h) APPS OTHERS USE. 
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INTERROGATORY NO. 26 

Provide, for each year during the RELEVANT PERIOD, the number of FACEBOOK 
USERS in California, expressed as a total number and percent of total USERS (or in the United 
States, if California data is not available), who changed their default settings for each of the 
following DATA CONTROLS: 

(a) AUDIENCE SELECTOR TOOL for status updates (e.g., “Who can see your 
future posts?”); ■ 

(b) AUDIENCE SELECTOR TOOL for Birthday; 

(c) AUDIENCE SELECTOR TOOL for Friends List; 

(d) AUDIENCE SELECTOR TOOL for email; 

(e) AUDIENCE SELECTOR TOOL for who could look-up a person’s profile by 
contact information; 

(f) GRANULAR DATA PERMISSIONS; 

(g) PLATFORM OPT OUT; and, 

(h) APPS OTHERS USE. 

INTERROGATORY NO. 27 

If a USER set their PROFILE CONTROLS to “Friends,” “Friends of Friends,” or “Only 
Me,” explain what, if any, non-public USER INFORMATION the following entities could access 
during the RELEVANT PERIOD: 

(a) A THIRD PARTY APPLICATION; 

(b) An experience provided by an INTEGRATION PARTNERSHIP; 

(c) A website using information under an INSTANT PERSONALIZATION 
PARTNERSHIP; 

(d) An application subject to an EXTENDED API ACCESS PARTNERSPIIP; and, 

(e) Any third party entity not covered in the responses to subparts (a) through (d). 
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INTERROGATORY NO. 28 

If a USER disabled FACEBOOIC’S platform for THIRD PARTY APPLICATIONS by 
using the PLATFORM OPT-OUT setting, explain what, if any, non-public USER 
INFORMATION the following entities could access during the RELEVANT PERIOD: 

(a) A THIRD PARTY APPLICATION; 

(b) An experience provided by an INTEGRATION PARTNERSHIP; 

(c) A website using information under an INSTANT PERSONALIZATION 
PARTNERSHIP; 

(d) An application subject to an EXTENDED API ACCESS PARTNERSHIP; and, 

(e) Any third party not covered in the responses to subparts (a) through (d). 
INTERROGATORY NO. 29 

J 

If a USER sets their APPS OTHERS USE settings to minimize or eliminate data being 
shared about a USER through FRIENDS, explain what, if any, non-public USER 
INFORMATION the following entities could access about a USER through FRIENDS that had 
installed the entity’s relevant app, website, game, or experience during the RELEVANT 
PERIOD: 

(a) A THIRD PARTY APPLICATION; 

(b) An experience provided by an INTEGRATION PARTNERSHIP; 

(c) A website using information under an INSTANT PERSONALIZATION 
PARTNERSHIP; 

(d) An application subject to an EXTENDED API ACCESS PARTNERSHIP; and, 

(e) Any third party not covered in the responses to subparts (a) through (d). 
INTERROGATORY NO. 30 

If a USER implemented FACEBOOIC’s DATA CONTROLS to minimize the USER 

INFORMATION that is SHARED with others, including setting all PROFILE CONTROLS to 

“Friends,” disabling Platform through the PLATFORM OPT-OUT, and restricting all data 

sharing under the APPS OTHERS USE, describe what USER INFORMATION each of the 

following could access during the RELEVANT PERIOD: 

8 


FACEBOOK, INC. 


INVESTIGATIVE INTERROGATORIES [SET TWO] 




1 

2 
3 
. 4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 


(a) A THIRD PARTY APPLICATION; 

(b) An experience provided by an INTEGRATION PARTNERSHIP; 

(c) A website using information under an INSTANT PERSONALIZATION 
■PARTNERSHIP; 

(d) An application subject to an EXTENDED API ACCESS PARTNERSHIP; and, 

(e) Any third party not covered in the responses to subparts (a) through (d). 
INTERROGATORY NO. 31 

Provide the following information about any DEVELOPERS that could access non-public 
USER INFORMATION through the USER’S FRIEND, despite the USER engaging the APPS 
OTHERS USE control: 

• (a) Identity of the third party; 

' (b) What USER INFORMATION it could access; 

(c) Whether the third party could access data through FRIENDS of FRIENDS; 

(d) When the access began and ended; 

(e) The reasons FACEBOOK allowed access to USER INFORMATION; and, 

(f) What disclosures provided notice to USERS that their data could be shared in this 
way. 

INTERROGATORY NO. 32 

Describe the process by which FACEBOOK reviewed, developed, and approved changes 
to DATA CONTROLS during the RELEVANT PERIOD. 

INTERROGATORY NO. 33 

Identify, by name and team assignment, all the individuals at FACEBOOK who 
developed and approved changes to Facebook’s DATA CONTROLS during the RELEVANT ■ 
PERIOD. 

INTERROGATORY NO. 34 

Describe the review, evaluation, and testing of any new or modified DATA CONTROL 
during the RELEVANT PERIOD, including how FACEBOOK tested or evaluated a USER’S 
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response or understanding of a new or modified DATA CONTROL through usability or A/B . 
testing, 

INTERROGATORY NO. 3 5 

Describe the “coding rules” that “automatically identify and review apps that engage in 
acts that signal potentially abusive behavior” identified on page 11 of the July 20, 2018 letter 
from Anjan Sahni to Stacey D, Schesser and Lisa B, Kim. 

INTERROGATORY NO. 36 . 

State the number of times that the “coding rules” identified on page 11 of the July 20, 

2018 letter from Anjan Salmi to Stacey D. Schesser and Lisa B. Kim, detected a potential abuse 
of FACEBOOK’s DEVELOPER POLICIES during the RELEVANT PERIOD, broken down by 
year and for each instance explain who the DEVELOPER was and what coding rule was 
implicated. 

INTERROGATORY NO. 37 

For each year during the RELEVANT PERIOD, state the number of times that 
FACEBOOK received a report of a potential violation of its DEVELOPER POLICIES by a 
DEVELOPER from each of the following sources; (a) USERS; (b) FACEBOOK employees; (c) 
the press; and (d) security or white-hat researchers. • ' . ■ 

INTERROGATORY NO, 38 

Explain the term “shielded app,” as that term is used in the document bearing the Bates 
label FB-CA-CAAG-00037551. 

INTERROGATORY NO, 39 

Describe the manner in which YOU enforced DEVELOPER POLICIES on DEVELOPERS 
of “shielded apps,” as that term is used in the document bearing the Bates label FB-CA-CAAG- 
00037551. Please identify any differences in the manner in which YOU enforced DEVELOPER 
POLICIES, or any other applicable POLICIES, against “shielded apps” as compared to other 
THIRD PARTY APPLICATIONS. 
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For each year during the RELEVANT PERIOD, specify how many enforcement actions 
YOU undertook in each 1 of the following categories identified in the enforcement rubric set forth 
in the document bearing the Bates label FB-CA-CAAG-00019954: 

(a) Surface or escalate to point of contact; 

(b) Warning (of any length); 

(c) Moratorium; 

(d) Removal from approved advertiser list; 

(e) Disable credits; 

(f) Disable; and, 

(g) Escalate to Legal for a cease and desist letter. 

INTERROGATORY NO. 41 

Identify all instances when FACEBOOIC deviated its response from the “recommended 
action” for each perceived violation of DEVELOPER POLICIES, as set forth in the document 
bearing the Bates label FB-CA-CAAG-00019954. For each instance, state the action taken, and 
the reason why FACEBOOIC deviated its response, 

INTERROGATORY NO. 42 

Describe what steps FACEBOOK took, if any, to ensure that applications created pursuant 
to an INTEGRATED PARTNERSHIP or an EXTENDED API ACCESS PARTNERSHIP did 
not access or use data for any purpose other than what was authorized by FACEBOOIC’s 
agreements with the partner. 

INTERROGATORY NO. 43 

For each year during 2013 to 2017, state how many times FACEBOOIC has suspended or 
disabled access to USER INFORMATION by THIRD PARTY APPLICATIONS, or their 
DEVELOPERS, for violation of the following DEVELOPER POLICIES requirements: 
Developers shall: only request the data needed to operate their application; only 
use the data received from Facebook for their application; obtain explicit consent 
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from the user who provided the data to Facebook before using it for any purpose 

2 other than displaying it back to the user; 

3 Developers shall not: transfer any data that they receive from Facebook; sell user 

4 data; use Facebook user IDs for any purpose outside of their applications; use a 

5 user‘s friend list outside of their application; access a user’s friend list when a 

6 friend connects with that app; if a fiend grants specific permission, use that 

7 content and information other than in connection with that friend. 

8 INTERROGATORY NO. 44 

9 Has FACEBOOK ever suspended or disabled access to USER INFORMATION by an 

I o . INTEGRATED PARTNER, EXTENDED API ACCESS PARTNER, or INSTANT 

II PERSONALIZATION PARTNER because the DEVELOPER appeared to have violated either 

12 FACEBOOK’s DEVELOPER POLICIES regarding USER INFORMATION or the parties’ 

13 agreement regarding USER INFORMATION? If so, please identify the DEVELOPER, the 

14 details of the suspected violation, arid how FACEBOOK learned of the suspected violation. 

15 INTERROGATORY NO. 45 

1 6 Excluding 1) USERS, 2) INTEGRATED PARTNERS, 3) INSTANT 

17 PERSONALIZATION PARTNERS, and 4) THIRD PARTY APPLICATION DEVELOPERS 

1 8 operating under FACEBOOK’s DEVELOPER POLICIES, identify any other persons or entities 

19 to whom FACEBOOK granted access to USER INFORMATION, by: 

20 (a) The name of the third party; 

21 (b) The USER INFORMATION available to the third party; 

22 (c) The reason the third party was granted access; and, 

23 (d) The dates that access began and ended. 

24 INTERROGATORY NO. 46 

25 Describe the different FACEBOOK APIs that DEVELOPERS could use to access USER 

26 INFORMATION during the RELEVANT PERIOD. 
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INTERROGATORY NO. 47 


2 

Identify the APIs that each of the following entities could use to access USER 


3 

INFORMATION during the RELEVANT PERIOD: 


4 

(a) A DEVELOPER of a THIRD PARTY APPLICATION; 


5 

(b) An INTEGRATION PARTNER; 


6 

(c) An INSTANT PERSONALIZATION PARTNER; and, 


7 

(d) An EXTENDED API ACCESS PARTNER. 


8 

INTERROGATORY NO. 48 


9 

Did FACEBOOK ever factor a DEVELOPER’S advertising purchase history or amount 


10 

spent into .the decision to enter into, continue, or terminate an EXTENDED API ACCESS 


11 

PARTNERSHIP? If so, please describe the circumstances. 
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13 

Did FACEBOOK ever factor a DEVELOPER’S advertising purchase history or amount 


14 

spent into the decisions as to what capabilities or access to USER INFORMATION to grant 


15 

pursuant to an EXTENDED API ACCESS PARTNERSHIP? If so, please describe the 


16 

circumstances. 


17 

INTERROGATORY NO. 50 


18 

Describe FACEBOOIC’s history of auditing the use or handling of USER INFORMATION 


19 

by DEVELOPERS, including whether FACEBOOK ever considered conducting audits, actually 


20 

conducted any audits, and, if so, what it found. Please exclude: (A) information regarding an 
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individual investigation into a particular DEVELOPER’S use of data, and (B) information about 
the ADI process previously disclosed by FACEBOOK. 


FAILURE TO COMPLY WITH THIS SUBPOENA WILL SUBJECT YOU TO THE 
PROCEEDINGS AND PENALTIES PROVIDED BY LAW. 


Dated: June 17,2019 Xavier Becerra 

Attorney General of California 

Nictclas A. Akers 

Senior Assistant Attorney General 

Stacey D. Schesser 

Supervising Deputy Attorney General 

Lisa B. Kim 

Susan Saylor 

Micah C.E. Osgood 

Maneesh Sharma 

Deputy Attorneys General 



Lis£-B-JLim 
Deputy Attorney General 
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□ Environmental/Toxic tort (30) 

□ Insurance coverage claims arising from the 
above listed provisionally complex case 
types (41) 

Enfo rcement of Judgment 

□ Enforcement of judgment (20) 
Miscellaneous Civil Complaint 

□ RICO (27) 

n Other complaint (not specified above) (42) 


Unlawful Detainer I_I Enforcement ot judgment (20) 

□ Defamation (13) □ Commercial (31) Miscellaneous Civil Complaint I 

□ Fraud (16) □ Residential (32) ZD RICO (27) 

I -1 Intellectual property (19) I -1 Drugs (38) I I Other complaint (not specified above) (42) 

□ Professional negligence (25) Judicial Review Miscellaneous Civil Petition 

L—1 Other non-PI/PD/WD tort (35) L_J Asset forfeiture (05) 1 I Partnership and corporate governance (21) 

Emp'oynum 1 LJ Petition re: arbitration award (11) ^2 Other petition (not specified above) (43) 

I I Wrongful termination (36) |_| Writ of mandate (02) 

j P Other employment (15) _ 1 I Other judicial review (39) _ 

2. This case I I is I / 1 is not complex under rule 3.400 of the California Rules of Court. If the case is complex, mark the 
factors requiring exceptional judicial management: 

a. I 1 Large number of separately represented parties d. I I Large number of witnesses 

b. I I Extensive motion practice raising difficult or novel e. I I Coordination with related actions pending in one or more courts 

issues that will be time-consuming to resolve _ in other counties, states, or countries, or in a federal court 

c. 1 I Substantial amount of documentary evidence f. I_1 Substantial postjudgment judicial supervision 


a. I 1 Large number of separately represented parties d. I I Large number of witnesses 

b. I I Extensive motion practice raising difficult or novel e. I I Coordination with related actions pending in one or more courts 

issues that will be time-consuming to resolve _ in other counties, states, or countries, or in a federal court 

c. 1 I Substantial amount of documentary evidence f. I_1 Substantial postjudgment judicial supervision 

3. Remedies sought (check all that apply): a. I I monetary b. lVj nonmonetary; declaratory or injunctive relief c. I I punitive 

4. Number of causes of action (specify): N/A 

5. This case I I is IS is not a class action suit. 

6. If there are any known related cases, file and serve a notice of related case. (You may use form CM-015.) / 

Date: Nov. 4,2019 k / ~/l /[ TV_ / 

Micah C.E. Osgood f / V/ / 

(TYPE OR PRINT NAME) (SIGNATURE d^PARTY ORyUTORNEY FOR PARTY) 

NOTICE ^-^ 

• Plaintiff must file this cover sheet with the first paper filed in the action or proceeding (except small claims cases or cases filed 
under the Probate Code, Family Code, or Welfare and Institutions Code). (Cal. Rules of Court, rule 3.220.) Failure to file may result 
in sanctions. 

• File this cover sheet in addition to any cover sheet required by local court rule. 

• If this case is complex under rule 3.400 et seq. of the California Rules of Court, you must serve a copy of this cover sheet on all 
other parties to the action or proceeding. 

• Unless this is a collections case under rule 3.740 or a complex case, this cover sheet will be used for statistical purposes only. | 
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3. ( you ma\ 

YU 


(SIGNATURE OF/PARTY OR\ATTORNEY FOR PARTY) 
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